Overview: Multi-Factor Authentication (MFA) adds a second step to signing in, so if your password becomes compromised, it isn't enough to reach your account. You can set it up on your own profile from the Buddy Punch website using an authenticator app, a passkey, or both.
Important! Multi-Factor Authentication is available on every Buddy Punch account. It is no longer limited to accounts using Buddy Punch Payroll.
Whether it's optional or required is decided account-wide by your Account Administrator. If you're being asked to set it up and aren't sure why, please reach out to your Account Administrator.
Instructions:
Set Up an Authenticator App
1. Start by clicking your profile icon in the top right corner, then My Profile:
2. Scroll to the Multi-Factor Authentication section and click Set up authenticator app:
3. Scan the QR code with an authenticator app on your phone — Google Authenticator, Microsoft Authenticator, Authy, and 1Password all work. If you can't scan it, enter the key printed beneath the code manually instead. Then enter the 6-digit code your app generates and click Verify:
4. Your recovery codes appear next. This is the only time they are shown, so click Download as .txt and keep the file somewhere safe — these are what get you back in if you lose your phone. Then click Done:
Note: Each recovery code works once, and can be entered in place of an authenticator code if you don't have your phone. If you use them up or lose the file, you can create a fresh set from My Profile --> Regenerate recovery codes.
5. Back on My Profile, the Multi-Factor Authentication section now reads Authenticator app — Configured. From here you can remove the authenticator or regenerate your recovery codes at any time:
Add a Passkey
A passkey lets you finish signing in with your device's fingerprint, face, or screen lock instead of typing a code — the same way you unlock your phone.
Note: A passkey doesn't replace your password. You still sign in with your username and password first, then approve with the passkey.
1. From My Profile, in the Multi-Factor Authentication section, click Add a passkey:
2. Give the passkey a name if you'd like, so you can recognize which device it belongs to later, then click Create passkey:
3. Approve the prompt that your device shows — Touch ID, Face ID, Windows Hello, your screen lock, or a security key:
4. Once approved, the passkey is listed in the Multi-Factor Authentication section of your profile, where you can remove it later if you stop using that device:
Note: A passkey belongs to the device and browser you created it on, plus any device your iCloud Keychain or Google Password Manager syncs it to. If you sign in from more than one computer, add a passkey on each one or keep an authenticator app set up as a backup.
FAQs
Q: Do I have to set this up?
A: That depends on what your Account Administrator has chosen for your company. If it's required, you'll be asked to set it up the next time you log in and won't be able to skip it. If it's optional, it's up to you. Companies using Buddy Punch Payroll always require it.
Q: Will I need my phone every time I clock in?
A: No. You're asked for a code when you sign in, not every time you punch. If you tick Remember this browser? on the verification screen, that browser won't ask again for 14 days.
Q: What if I lose my phone or get a new one?
A: Enter one of your recovery codes in place of the authenticator code. If you've used them all or never saved the file, ask your Account Administrator to reset Multi-Factor Authentication on your profile — that lets you set it up again on your new phone at your next login.
Q: I don't have a smartphone. What are my options?
A: Authenticator apps are also available as desktop apps and browser extensions, and a passkey can use your computer's fingerprint reader, face recognition, or screen lock, or a hardware security key. If none of those work for you, please reach out to your Account Administrator.
Q: Can I get my codes by text message instead?
A: Text message codes still work for people who already had them set up, but they aren't offered for new setups. An authenticator app or a passkey is offered instead, as both are harder for someone to intercept than a text.
Q: Do I need to set this up in the Buddy Punch mobile app too?
A: No. Multi-Factor Authentication applies when signing in on the website. The mobile app doesn't currently ask for it.